21 KiB
.NET Core 2.2.1 January 2019 Update - January 08, 2019
.NET Core 2.2.1 is available for download and usage in your environment. This release includes .NET Core 2.2.1, ASP.NET Core 2.2.1 and .NET Core SDK 2.2.102.
Visit the .NET Core blog to read more about this release. Your feedback is important and appreciated. We've created an issue at dotnet/core #XXXX for your questions and comments.
Downloads
SDK Installer1 | SDK Binaries1 | Runtime Installer | Runtime Binaries | ASP.NET Core Runtime | |
---|---|---|---|---|---|
Windows | x86 | x64 | x86 | x64 | x86 | x64 | x86 | x64 | x86 | x64 Hosting Bundle2 |
macOS | x64 | x64 | x64 | x64 | x641 |
Linux | See installations steps below | x64 | ARM | ARM64 | x64 Alpine | - | x64 | ARM | ARM64 | x64 Alpine] | x641 | ARM321 | x64 Alpine1 |
RHEL6 | - | x64 | - | x64 | - |
Checksums | SDK | - | Runtime | - | - |
Symbols | CLI | SDK | - | Runtime | Shared Framework | Setup | - | ASP.NET Core |
- Includes the .NET Core and ASP.NET Core Runtimes
- For hosting stand-alone apps on Windows Servers. Includes the ASP.NET Core Module for IIS and can be installed separately on servers without installing .NET Core runtime.
Docker Images
The .NET Core Docker images have been updated for this release. Details on our Docker versioning and how to work with the images can be seen in "Staying up-to-date with .NET Container Images".
The following repos have been updated
Azure AppServices
- .NET Core 2.2.1 is being deployed to Azure App Services and the deployment is expected to complete in a couple of days.
.NET Core Lifecycle News
See .NET Core Supported OS Lifecycle Policy to learn about Windows, macOS and Linux versions that are supported for each .NET Core release.
- Support for Fedora 27 has ended as of November 30, 2018.
- Support for Fedora 29 has been added for .NET Core 2.2.
Changes in 2.2.1
.NET Core 2.2.1 release carries both security and non-security fixes, covering the listed vulnerabilites (see CVEs below), changes related to the addition of new era to the Japanese calendar, support for running in a sandbox on Mac, and several other reliability fixes. All fixes of note can be seen in the 2.2.1 commits list.
-
CVE-2019-0545: .NET Core Information Disclosure Vulnerability
Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in .NET Core 2.1 and 2.2. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
Microsoft is aware of an information disclosure vulnerability exists in .NET Framework and .NET Core which allows bypassing Cross-origin Resource Sharing (CORS) configurations. An attacker who successfully exploited the vulnerability could retrieve content, that is normally restricted, from a web application.
The security update addresses the vulnerability by enforcing CORS configuration to prevent its bypass.
-
CVE-2019-0548: ASP.NET Core Denial Of Service Vulnerability
Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in public ASP.NET Core 1.0, 1.1 and 2.1. This advisory also provides guidance on what developers can do to update their applications correctly.
Microsoft is aware of a security vulnerability in all public versions of ASP.NET Core where, if an application is hosted on Internet Information Server (IIS) a remote unauthenticated attacker can use a specially crafted request can cause a Denial of Service.
-
CVE-2019-0564: ASP.NET Core Denial Of Service Vulnerability
Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core 2.1 and 2.2. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
Microsoft is aware of a denial of service vulnerability exists when ASP.NET Core improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against an ASP.NET Core web application. The vulnerability can be exploited remotely, without authentication.
A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET Core application.
The update addresses the vulnerability by correcting how the ASP.NET Core web application handles web requests.
Package and Binary updates
Package name Vulnerable versions Secure versions Microsoft.AspNetCore.WebSockets 2.2.0
2.1.0, 2.1.12.2.1
2.1.7Microsoft.AspNetCore.Server.Kestrel.Core 2.1.0, 2.1.1, 2.1.2, 2.1.3 2.1.7 System.Net.WebSockets.WebSocketProtocol 4.5.0, 4.5.1, 4.5.2 4.5.3 Microsoft.NETCore.App 2.2.0
2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.1.5, 2.1.62.2.1
2.1.7Microsoft.AspNetCore.App 2.2.0
2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.1.5, 2.1.62.2.1
2.1.7Microsoft.AspNetCore.All 2.2.0
2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.1.5, 2.1.62.2.1
2.1.7
Packages updated as part of this release:
Package name | Version |
---|---|
dotnet-aspnet-codegenerator | 2.2.1 |
dotnet-ef | 2.2.1 |
Microsoft.AspNetCore.All | 2.2.1 |
Microsoft.AspNetCore.App | 2.2.1 |
Microsoft.AspNetCore.Diagnostics.EntityFrameworkCore | 2.2.1 |
Microsoft.AspNetCore.Server.IIS | 2.2.1 |
Microsoft.AspNetCore.Server.IISIntegration | 2.2.1 |
Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets | 2.2.1 |
Microsoft.AspNetCore.WebSockets | 2.2.1 |
Microsoft.Data.Sqlite | 2.2.1 |
Microsoft.Data.Sqlite.Core | 2.2.1 |
Microsoft.DotNet.Web.Client.ItemTemplates | 2.2.1 |
Microsoft.DotNet.Web.ItemTemplates | 2.2.1 |
Microsoft.DotNet.Web.ProjectTemplates.2.2 | 2.2.1 |
Microsoft.DotNet.Web.Spa.ProjectTemplates | 2.2.1 |
Microsoft.EntityFrameworkCore | 2.2.1 |
Microsoft.EntityFrameworkCore.Abstractions | 2.2.1 |
Microsoft.EntityFrameworkCore.Analyzers | 2.2.1 |
Microsoft.EntityFrameworkCore.Design | 2.2.1 |
Microsoft.EntityFrameworkCore.InMemory | 2.2.1 |
Microsoft.EntityFrameworkCore.Proxies | 2.2.1 |
Microsoft.EntityFrameworkCore.Relational | 2.2.1 |
Microsoft.EntityFrameworkCore.Relational.Specification.Tests | 2.2.1 |
Microsoft.EntityFrameworkCore.Specification.Tests | 2.2.1 |
Microsoft.EntityFrameworkCore.Sqlite | 2.2.1 |
Microsoft.EntityFrameworkCore.Sqlite.Core | 2.2.1 |
Microsoft.EntityFrameworkCore.Sqlite.NetTopologySuite | 2.2.1 |
Microsoft.EntityFrameworkCore.SqlServer | 2.2.1 |
Microsoft.EntityFrameworkCore.SqlServer.NetTopologySuite | 2.2.1 |
Microsoft.EntityFrameworkCore.Tools | 2.2.1 |
Microsoft.NETCore.App | 2.2.1 |
Microsoft.NETCore.DotNetAppHost | 2.2.1 |
Microsoft.NETCore.DotNetHost | 2.2.1 |
Microsoft.NETCore.DotNetHostPolicy | 2.2.1 |
Microsoft.NETCore.DotNetHostResolver | 2.2.1 |
Microsoft.VisualStudio.Web.CodeGeneration | 2.2.1 |
Microsoft.VisualStudio.Web.CodeGeneration.Contracts | 2.2.1 |
Microsoft.VisualStudio.Web.CodeGeneration.Core | 2.2.1 |
Microsoft.VisualStudio.Web.CodeGeneration.Design | 2.2.1 |
Microsoft.VisualStudio.Web.CodeGeneration.EntityFrameworkCore | 2.2.1 |
Microsoft.VisualStudio.Web.CodeGeneration.Templating | 2.2.1 |
Microsoft.VisualStudio.Web.CodeGeneration.Utils | 2.2.1 |
Microsoft.VisualStudio.Web.CodeGenerators.Mvc | 2.2.1 |
runtime.linux-arm.Microsoft.NETCore.App | 2.2.1 |
runtime.linux-arm.Microsoft.NETCore.DotNetAppHost | 2.2.1 |
runtime.linux-arm.Microsoft.NETCore.DotNetHost | 2.2.1 |
runtime.linux-arm.Microsoft.NETCore.DotNetHostPolicy | 2.2.1 |
runtime.linux-arm.Microsoft.NETCore.DotNetHostResolver | 2.2.1 |
runtime.linux-arm64.Microsoft.NETCore.App | 2.2.1 |
runtime.linux-arm64.Microsoft.NETCore.DotNetAppHost | 2.2.1 |
runtime.linux-arm64.Microsoft.NETCore.DotNetHost | 2.2.1 |
runtime.linux-arm64.Microsoft.NETCore.DotNetHostPolicy | 2.2.1 |
runtime.linux-arm64.Microsoft.NETCore.DotNetHostResolver | 2.2.1 |
runtime.linux-musl-x64.Microsoft.NETCore.App | 2.2.1 |
runtime.linux-musl-x64.Microsoft.NETCore.DotNetAppHost | 2.2.1 |
runtime.linux-musl-x64.Microsoft.NETCore.DotNetHost | 2.2.1 |
runtime.linux-musl-x64.Microsoft.NETCore.DotNetHostPolicy | 2.2.1 |
runtime.linux-musl-x64.Microsoft.NETCore.DotNetHostResolver | 2.2.1 |
runtime.linux-x64.Microsoft.NETCore.App | 2.2.1 |
runtime.linux-x64.Microsoft.NETCore.DotNetAppHost | 2.2.1 |
runtime.linux-x64.Microsoft.NETCore.DotNetHost | 2.2.1 |
runtime.linux-x64.Microsoft.NETCore.DotNetHostPolicy | 2.2.1 |
runtime.linux-x64.Microsoft.NETCore.DotNetHostResolver | 2.2.1 |
runtime.osx-x64.Microsoft.NETCore.App | 2.2.1 |
runtime.osx-x64.Microsoft.NETCore.DotNetAppHost | 2.2.1 |
runtime.osx-x64.Microsoft.NETCore.DotNetHost | 2.2.1 |
runtime.osx-x64.Microsoft.NETCore.DotNetHostPolicy | 2.2.1 |
runtime.osx-x64.Microsoft.NETCore.DotNetHostResolver | 2.2.1 |
runtime.rhel.6-x64.Microsoft.NETCore.App | 2.2.1 |
runtime.rhel.6-x64.Microsoft.NETCore.DotNetAppHost | 2.2.1 |
runtime.rhel.6-x64.Microsoft.NETCore.DotNetHost | 2.2.1 |
runtime.rhel.6-x64.Microsoft.NETCore.DotNetHostPolicy | 2.2.1 |
runtime.rhel.6-x64.Microsoft.NETCore.DotNetHostResolver | 2.2.1 |
runtime.win-arm.Microsoft.NETCore.App | 2.2.1 |
runtime.win-arm.Microsoft.NETCore.DotNetAppHost | 2.2.1 |
runtime.win-arm.Microsoft.NETCore.DotNetHost | 2.2.1 |
runtime.win-arm.Microsoft.NETCore.DotNetHostPolicy | 2.2.1 |
runtime.win-arm.Microsoft.NETCore.DotNetHostResolver | 2.2.1 |
runtime.win-arm64.Microsoft.NETCore.App | 2.2.1 |
runtime.win-arm64.Microsoft.NETCore.DotNetAppHost | 2.2.1 |
runtime.win-arm64.Microsoft.NETCore.DotNetHost | 2.2.1 |
runtime.win-arm64.Microsoft.NETCore.DotNetHostPolicy | 2.2.1 |
runtime.win-arm64.Microsoft.NETCore.DotNetHostResolver | 2.2.1 |
runtime.win-x64.Microsoft.NETCore.App | 2.2.1 |
runtime.win-x64.Microsoft.NETCore.DotNetAppHost | 2.2.1 |
runtime.win-x64.Microsoft.NETCore.DotNetHost | 2.2.1 |
runtime.win-x64.Microsoft.NETCore.DotNetHostPolicy | 2.2.1 |
runtime.win-x64.Microsoft.NETCore.DotNetHostResolver | 2.2.1 |
runtime.win-x86.Microsoft.NETCore.App | 2.2.1 |
runtime.win-x86.Microsoft.NETCore.DotNetAppHost | 2.2.1 |
runtime.win-x86.Microsoft.NETCore.DotNetHost | 2.2.1 |
runtime.win-x86.Microsoft.NETCore.DotNetHostPolicy | 2.2.1 |
runtime.win-x86.Microsoft.NETCore.DotNetHostResolver | 2.2.1 |
System.Net.WebSockets.WebSocketProtocol | 4.5.3 |